diff --git a/0016-change-default-umask-to-0022.patch b/0016-change-default-umask-to-0022.patch
new file mode 100644
index 0000000..a47a82b
--- /dev/null
+++ b/0016-change-default-umask-to-0022.patch
@@ -0,0 +1,26 @@
+From 53ba0431c50a618bee0e17315ec176e6c400ed86 Mon Sep 17 00:00:00 2001
+From: WangFengTu <wangfengtu@huawei.com>
+Date: Mon, 15 Aug 2022 19:41:27 +0800
+Subject: [PATCH] change default umask to 0022
+
+Signed-off-by: WangFengTu <wangfengtu@huawei.com>
+---
+ src/contrib/config/daemon.json | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/contrib/config/daemon.json b/src/contrib/config/daemon.json
+index 92cd6c47..75fc25ad 100644
+--- a/src/contrib/config/daemon.json
++++ b/src/contrib/config/daemon.json
+@@ -27,7 +27,7 @@
+     "insecure-registries": [
+     ],
+     "pod-sandbox-image": "",
+-    "native.umask": "secure",
++    "native.umask": "normal",
+     "network-plugin": "",
+     "cni-bin-dir": "",
+     "cni-conf-dir": "",
+-- 
+2.25.1
+
diff --git a/iSulad.spec b/iSulad.spec
index 6c702ca..ea88b12 100644
--- a/iSulad.spec
+++ b/iSulad.spec
@@ -1,5 +1,5 @@
 %global _version 2.0.15
-%global _release 3
+%global _release 4
 %global is_systemd 1
 %global enable_shimv2 1
 %global is_embedded 1
@@ -28,6 +28,7 @@ Patch6011: 0012-fix-lose-override-flag.patch
 Patch6012: 0013-Add-read-and-execute-permissions-for-libhttpclient.s.patch
 Patch6013: 0014-fix-exec_request_to_rest-forgot-to-handle-suffix.patch
 Patch6014: 0015-add-fuzz-dict.patch
+Patch6015: 0016-change-default-umask-to-0022.patch
 
 %ifarch x86_64 aarch64
 Provides:       libhttpclient.so()(64bit)
@@ -255,6 +256,12 @@ fi
 %endif
 
 %changelog
+* Mon Aug 15 2022 wangfengtu <wangfengtu@huawei.com> - 2.0.15-4
+- Type: enhancement
+- ID: NA
+- SUG: NA
+- DESC: change default umask to 0022
+
 * Tue Aug 9 2022 haozi007 <liuhao27@huawei.com> - 2.0.15-3
 - Type: enhancement
 - ID: NA